Docker PHP容器中kdevtmpfsi进程CPU占用100%问题求助

在包含PHP 8.2-FPM、Nginx、MySQL、RabbitMQ的Docker多容器环境中，仅api_php容器运行时会出现kdevtmpfsi进程占用100% CPU的情况，停止该容器后CPU占用恢复正常。

相关配置 #

Dockerfile（PHP） #

# Use the official PHP image with PHP 8.2 as the base image
FROM php:8.2-fpm

# Install PHP extensions and dependencies
RUN apt-get update && \
    apt-get install -y \
        libicu-dev \
        cron \
        vim \
        supervisor \
        git \
        zip \
        unzip \
        imagemagick \
        libmagickwand-dev \
        zlib1g-dev \
        libpng-dev && \
    pecl install imagick && \
    docker-php-ext-enable imagick && \
    docker-php-ext-install pdo_mysql sockets intl gd

# Install Composer
RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" && \
    php composer-setup.php --install-dir=/usr/local/bin --filename=composer && \
    php -r "unlink('composer-setup.php');"

# Set the environment variables for libsodium
ENV LIBSODIUM_CFLAGS="-I/usr/include/libsodium"
ENV LIBSODIUM_LIBS="-lsodium"
ENV ZLIB_CFLAGS="-I/usr/local/include"
ENV ZLIB_LIBS="-L/usr/local/lib -lz"
ENV PNG_CFLAGS="-I/usr/local/include"
ENV PNG_LIBS="-L/usr/local/lib -lpng"
ENV MAGICKWAND_CONFIG_PATH /usr/bin/MagickWand-config

# Set the working directory in the container
WORKDIR /var/www/html

# Copy the remaining application files to the container
COPY . .

# Expose port 9000 for PHP-FPM
EXPOSE 9000

# Start PHP-FPM
CMD ["php-fpm"]

Docker Compose（相关部分） #

version: '3'
services:
  api_nginx:
    container_name: "api_nginx"
    restart: unless-stopped
    image: api_nginx
    build:
      context: ./docker/nginx
      dockerfile: Dockerfile
    ports:
      - 8081:80
    volumes:
      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf
      - ./public:/var/www/html/public
    depends_on:
      - api_php
    networks:
      - api_network
  api_php:
    container_name: "api_php"
    restart: unless-stopped
    image: "api_php"
    build:
      context: ./docker/php
      dockerfile: Dockerfile
    ports:
      - "9001:9000"
    volumes:
      - ./docker/supervisord:/etc/supervisor/conf.d
      - .:/var/www/html
    command: sh -c "composer install --no-dev --optimize-autoloader && /usr/bin/supervisord"
    networks:
      - api_network
  api_mysql:
    container_name: "api_mysql"
    restart: unless-stopped
    image: api_mysql
    build:
      context: ./docker/mysql
      dockerfile: Dockerfile
    command: --default-authentication-plugin=mysql_native_password
    env_file:
      - docker/mysql/.env
    volumes:
      - ./docker/mysql/data:/var/lib/mysql
    ports:
      - 33061:3306
    environment:
      MYSQL_LOG_BIN_TRUST_FUNCTION_CREATORS: "1"
    networks:
      - api_network
  api_rabbitmq:
    container_name: "api_rabbitmq"
    restart: unless-stopped
    image: "api_rabbitmq"
    build:
      context: ./docker/rabbitmq
      dockerfile: Dockerfile
    environment:
      RABBITMQ_DEFAULT_USER: *****
      RABBITMQ_DEFAULT_PASS: ****
    volumes:
      - ./docker/rabbitmq/data:/var/lib/rabbitmq/
    ports:
      - 15001:15672
    networks:
      - api_network
networks:
  api_network:
    external: true

怀疑的问题原因 #

• 恶意软件或加密矿工（kdevtmpfsi进程存在可疑性）
• api_php容器配置错误导致资源异常占用

已执行的排查步骤 #

• 停止api_php容器，确认该容器为问题来源
• 检查系统日志，未发现明确线索
• 扫描主机及容器中的恶意文件与进程

已尝试的解决操作 #

• 重建api_php容器，问题依旧存在
• 查杀恶意程序，删除后kdevtmpfsi进程仍会重新出现并占用100% CPU

寻求解答的问题 #

1. api_php容器运行时kdevtmpfsi进程占用满CPU的原因是什么？
2. 如何区分该问题是恶意软件导致还是配置错误？
3. 如何在保障系统与容器安全的前提下解决此问题？

内容的提问来源于stack exchange，提问作者Karen Shahmuardayn